We're still working on this, but here are the basic principals:
Naturally, we share information about your purchases with producers so that they can give you the stuff you've purchased.
Some producers operate multiple sites. Purchases that you have made on one website will be shared with the producer, and therefore may be shared with other websites.
However, while we do share purchase data, we generate a unique customer ID which we provide to producers. This means that if you purchase items from different producers, they can't track you. We call this identifier the Producer-Consumer ID or PCID for short.
Since the PCID is unique for each producer, producers can only see what you've bought from them. Spotpass doesn't expose your purchase history to anyone other than the producer you're buying from.
Spotpass' use of a PCID means that purchasers can't use spotpass purchase data to track you through third-party identity aggregators.
We do what we can, but we have no control over the privacy safeguards of the sites you visit. While Spotpass does not attempt to identify you personally, and we limit the information we collect and share about you, this does not stop producers from using other means to identify you, and we can't stop them from sharing your purchase information.